@mpgd/adapter-capacitor 0.9.2 → 0.10.0

package/README.md

@@ -31,14 +31,17 @@ export function createGameGateway(providers: readonly CapacitorServiceProvider[]
 }
 ```
 
-`getCapabilities()` reports a fresh boolean snapshot and optional
-`providerAvailability` detail. The possible states are `unsupported`,
-`configuration-required`, `action-required`, `temporarily-unavailable`, and
-`available`. A target's `features` configuration is an upper bound, **not**
-proof that a provider is installed or ready. `nativeIap` describes one-time
-purchases; `subscriptionIap` is separate. Rewarded, interstitial, and banner
-ads and native versus remote leaderboards remain distinct. Target-config
-applies the configured upper bound to this live provider state.
+`getCapabilities()` reports a fresh boolean snapshot, optional
+`providerAvailability` detail, and the `commerce` capability block. The
+possible states are `unsupported`, `configuration-required`, `action-required`,
+`temporarily-unavailable`, and `available`. A target's `features` configuration
+is an upper bound, **not** proof that a provider is installed or ready.
+Commerce is not a provider feature: the `commerce` block (see below) is the
+only commerce source, and the retired `nativeIap` and `subscriptionIap` flags
+are never reported, even when a native shell built before commerce v2 still
+sends them. Rewarded, interstitial, and banner ads and native versus remote
+leaderboards remain distinct. Target-config applies the configured upper
+bound to this live provider state.
 
 When native and remote leaderboard routes coexist, the target-config wrapper
 selects a `route` on score/open calls; direct adapter callers can request
@@ -64,14 +67,14 @@ The source tests and installed-tarball consumer validate composition, types,
 error paths, and fallback behavior. They do not establish that any optional
 SDK works on a physical device or that a store/ad setup is release-ready.
 
-## Commerce v2 providers
+## Commerce providers
 
-Commerce v2 ([RFC](../../docs/specs/commerce/commerce-v2-rfc.md), PR B1) adds
-a second commerce surface next to the v1 `commerce.*` bridge methods. A store
-plugin exposes an in-process `StoreSdk`, the adapter turns it into a
-`CommerceProvider` from `@mpgd/platform/commerce`, and the provider registry
-serves both the six `commerce.v2.*` bridge methods and the four v1 methods
-from it.
+Commerce ([RFC](../../docs/specs/commerce/commerce-v2-rfc.md)) has one
+surface: the `CommerceProvider` from `@mpgd/platform/commerce`, exposed as
+`gateway.commerce` and served over the six `commerce.v2.*` bridge methods. A
+store plugin exposes an in-process `StoreSdk`, the adapter turns it into a
+`CommerceProvider`, and the provider registry serves it. The four v1
+`commerce.*` bridge methods and the v1 gateway object are removed.
 
 `StoreSdk` is shaped like the OpenIAP Client Protocol so a future Capacitor
 IAP plugin over the OpenIAP cores is a drop-in: `fetchProducts({ skus, type })`,
@@ -143,43 +146,72 @@ cannot advertise one the SDK lacks: `restore: true` without
 `sdk.restorePurchases`, like `finish: 'client' | 'host'` without
 `sdk.finishTransaction`, is rejected when the provider is created.
 
-`createCommerceServiceProvider` wraps the provider as a `CapacitorServiceProvider`
-whose `commerce` field the registry recognizes: the ten commerce bridge
-methods are implied (declaring a v1 `commerce.*` method alongside is an
-error), `nativeIap` and `subscriptionIap` readiness derive from
-`commerce.getCapabilities()`, and the in-process bridge delivers events as
-`{ protocol: 'mpgd.commerce.v2', sequence, event }` with a per-session
-sequence starting at 0. v1 callers keep working: `gateway.commerce` is served
-by `toCommerceAdapter(provider)`, so a `launched` purchase is `pending`, a
-synchronous purchase is `completed` with evidence and no entitlements, and
-`restore` returns no entitlements. The gateway exposes the v2 surface as
-`gateway.commerceV2` (served through the same validated bridge path, which
-the conformance test exercises for every store vector) and adds a `commerce`
-block to `getCapabilities()` from which `nativeIap` and `subscriptionIap` are
-derived. The block comes from the registry's one bounded read per snapshot
-(`getCapabilitySnapshot`, three-second timeout, shape validated): a stalled,
-failing, or invalid provider yields a degraded block
-(`createDegradedCommerceCapabilities`: `availability:
-'temporarily-unavailable'`, nothing sold, `nativeIap: false`) and never
-rejects the capability read. A `launched` v2 purchase keeps
-`beginExternalActivity()` open after the request returns, since the store UI
-is still up: the gateway releases it when the provider reports that product
-(`purchaseUpdated` or `purchaseError`), after
-`launchedPurchaseActivityTimeoutMs` (two minutes), or on `lifecycle.dispose`;
-the v1 `commerce.purchase` path has no event to wait for and releases when
-its request returns. Without a v2 provider nothing changes: `commerceV2` is
-absent and a `commerce.v2.*` request still answers `COMMERCE_V2_UNAVAILABLE`
-as the transport left it.
+`createCommerceServiceProvider({ id, commerce })` wraps the provider as a
+`CapacitorServiceProvider` whose `commerce` field the registry recognizes. It
+declares no `features` and no `methods`: the six `commerce.v2.*` bridge methods
+are implied (declaring one, or a retired v1 `commerce.*` method, is an error),
+the bridge must implement `subscribe`, and the in-process bridge delivers
+events as `{ protocol: 'mpgd.commerce.v2', sequence, event }` with a
+per-session sequence starting at 0. `CapacitorServiceProvider.features` lists
+non-commerce features only (`PlatformProviderFeature` has no IAP names), and a
+second commerce provider is a registration error.
+
+The gateway exposes the provider as `gateway.commerce` (served through the same
+validated bridge path, which the conformance test exercises for every store
+vector) and omits the property when no provider is registered. The
+`commerce` block of `getCapabilities()` is always present and is a fresh copy
+on every read: the provider's validated capability block, or
+`createUnsupportedCommerceCapabilities()` when no commerce provider is
+registered. A native `runtime.getCapabilities` answer is only the base: its
+`nativeIap` and `subscriptionIap` keys are stripped and its `commerce` block,
+whatever it says, is replaced. The block comes from the registry's one bounded
+read per snapshot (`getCapabilitySnapshot` returns `{ availability, commerce }`,
+three-second timeout, shape validated): a stalled, failing, or invalid
+provider yields a degraded block (`createDegradedCommerceCapabilities`:
+`availability: 'temporarily-unavailable'`, nothing sold) and never rejects the
+capability read. A `launched` purchase keeps `beginExternalActivity()` open
+after the request returns, since the store UI is still up: the gateway releases
+it when the provider reports that product (`purchaseUpdated` or
+`purchaseError`), after `launchedPurchaseActivityTimeoutMs` (two minutes), or
+on `lifecycle.dispose`. The registry does not gate a commerce method by a
+snapshot: the provider reads its own `availability` and fails closed before any
+store UI opens. A `commerce.v2.*` request that reaches a transport without a
+provider still answers `COMMERCE_V2_UNAVAILABLE`.
+
+Games do not call the provider from a scene: `createGameServicesClient` from
+`@mpgd/game-services` purchases through `createCommerceReconciler` over
+`gateway.commerce`, and nothing is granted from a client callback.
+
+## Notifications v2
+
+The notifications v2 provider arrives in PR P2 of the
+[notifications RFC](../../docs/specs/notifications/notifications-v2-rfc.md),
+together with the registry surface through which a provider serves the
+`notifications.v2.*` methods. Until then the gateway exposes no
+`notificationsV2`, and its request path never forwards a `notifications.v2.*`
+method to the base plugin: it answers `NOTIFICATIONS_V2_UNAVAILABLE`, which is
+not retryable, before it pauses the game. A provider cannot declare those
+methods in `methods`.
+
+Once P2 lets a provider serve `notifications.v2.*` methods, these rules apply:
+
+- `notifications.v2.requestPermission` and `notifications.v2.openSettings`
+  pause the game while they run, like `notifications.requestSubscription` and
+  `commerce.v2.requestPurchase`.
+- The provider registry passes `notifications.v2.*` through `assertMethodReady`
+  without a readiness check, as it does `commerce.v2.*`, so the provider's own
+  `unsupported` or `action-required` answers reach the game as answers.
+- The gateway validates each answer before the game sees it. Until P2 adds the
+  notifications v2 answers to that check, it rejects every one of them.
 
 ## App Store server-side transaction signatures
 
-The server-side verifier moved to `@mpgd/game-services/app-store-server`
+The server-side verifier lives in `@mpgd/game-services/app-store-server`
 (see the [game-services README](../../packages/game-services/README.md)):
 install the optional `@apple/app-store-server-library@3.1.0` peer next to
 `@mpgd/game-services` and import `createAppleSignedTransactionVerifier` from
-there. `@mpgd/adapter-capacitor/app-store-server` is deprecated: it re-exports
-the same function and options type for one release and is removed in the next
-major version. Supply DER-encoded Apple root certificates from the
+there. The former `@mpgd/adapter-capacitor/app-store-server` subpath, a
+deprecated re-export, was removed. Supply DER-encoded Apple root certificates from the
 [Apple PKI](https://www.apple.com/certificateauthority/), the game's bundle
 ID, environment, and production App Apple ID. Use the result as
 `signedTransactionVerifier` in `createAppStoreGameServicesEvidenceVerifier`.
@@ -194,6 +226,21 @@ evidence; it never grants a product. Retryable certificate-status failures
 remain pending, while invalid signatures are rejected. Mock verification does
 not prove a real App Store purchase or device delivery.
 
+### Migrating from v1
+
+Commerce v2 PR C4 removed the v1 surface in one major release.
+
+| Removed | Replacement |
+| --- | --- |
+| `gateway.commerce.getProducts / purchase / restore / getEntitlements` (v1 `CommerceAdapter`) | `gateway.commerce` is now the `CommerceProvider` (`fetchProducts`, `requestPurchase`, `getAvailablePurchases`, `finishTransaction?`, `restorePurchases?`, `subscribe`); games purchase through `@mpgd/game-services` |
+| `gateway.commerceV2` | `gateway.commerce` |
+| `commerce.getProducts`, `commerce.purchase`, `commerce.restore`, `commerce.getEntitlements` bridge methods and `toCommerceAdapter` | the six `commerce.v2.*` methods |
+| `nativeIap`, `subscriptionIap` in `getCapabilities()` and `providerAvailability` | `capabilities.commerce` (`purchase.consumable`, `purchase.durable`, `purchase.subscription`, `availability`) |
+| `'nativeIap'` / `'subscriptionIap'` in `CapacitorServiceProvider.features`; the `features` input of `createCommerceServiceProvider`; `CapacitorCommerceFeature`; `deriveCommerceFeatureStates` | omit `features`: a provider with `commerce` declares none, and its readiness is its capability block |
+| the `productType` parameter of `assertMethodReady`; `NATIVE_PROVIDER_PRODUCT_UNKNOWN`, `NATIVE_PROVIDER_PRODUCT_TYPE_REQUIRED` | none: product routing belongs to the commerce provider |
+| `CapacitorProviderCapabilitySnapshot.commerce?` (optional) | always present: the provider block, the degraded block, or the unsupported block |
+| `@mpgd/adapter-capacitor/app-store-server` | `@mpgd/game-services/app-store-server` |
+
 ## Opt-in AdMob rewarded ads
 
 Install `@capacitor-community/admob@8.1.0` in the game-owned Capacitor project,
@@ -316,6 +363,19 @@ app. Cold URLs are read through `getInitialGameUrl` or
 callback. Call `lifecycle.dispose()` when the host tears down this gateway;
 the adapter removes only its own listener handles, never every App listener.
 
+A game link is untrusted input. The adapter checks the link's path, query, and
+fragment with `normalizeRootRelativeRoute` from `@mpgd/platform/routes` and
+discards a link that rule refuses, such as `mygame://game//evil.example/x` or
+`https://game.example/%2F%2Fevil.example/x`, because a client could read its
+path as another host. A delivered event carries the checked path as `route`:
+`/daily` for `mygame://game/daily`, as in the example above, where the host
+only names the link kind. The host is never part of `route`, so
+`mygame://level/3` gives `/3`. A router that routes by path opens
+`event.route` rather than parsing `event.url`. A link with no path to check,
+such as `mygame://daily`, arrives without `route`. A router that builds its
+route from anything else in the URL, such as the host, checks that route with
+`normalizeRootRelativeRoute` and opens only what it returns.
+
 Save progress at checkpoints and transaction boundaries. A pause callback can
 request a best-effort save, but neither pause nor back is guaranteed to run
 before the operating system terminates a process. The lifecycle tests use an

package/dist/app-events.d.ts

@@ -11,7 +11,11 @@ export interface CreateCapacitorAppEventsInput {
   readonly target: 'android' | 'ios';
   readonly app?: CapacitorAppEventsApi;
   readonly visibility?: CapacitorVisibilitySource | null;
-  /** Return null for URLs that this game does not own. Never default OAuth to game. */
+  /**
+  * Return null for URLs that this game does not own. Never default OAuth to
+  * game. A game link is then delivered only when its path passes the shared
+  * route rule (see `NativeOpenUrlEvent.route`).
+  */
   readonly classifyIncomingUrl?: (url: string) => CapacitorIncomingUrlKind | null;
   readonly historyBack?: () => void;
   readonly onError?: (error: unknown) => void;

package/dist/app-events.js

@@ -1,10 +1,41 @@
 import { App } from '@capacitor/app';
+import { hasRouteControlCharacter, normalizeRootRelativeRoute } from '@mpgd/platform/routes';
 const maxWarmUrlsBeforeInitial = 32;
 // Covers a near-simultaneous duplicate from getLaunchUrl and appUrlOpen, not a later tap.
 const coldUrlDedupeWindowMs = 2_000;
 function defaultVisibility() {
     return typeof document === 'undefined' ? null : document;
 }
+/**
+ * Reads a game link the way `NativeOpenUrlEvent.route` describes: its path,
+ * query, and fragment as a normalized route (the host is not part of it),
+ * `undefined` when the URL has no path to check (`mygame:daily`,
+ * `mygame://daily`), or `null` when the link is not delivered: it does not
+ * parse, carries a control character, or has a path `normalizeRootRelativeRoute`
+ * refuses because a client could read it as another host.
+ */
+function readGameLinkRoute(url) {
+    if (hasRouteControlCharacter(url)) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    const pathname = parsed.pathname === '' && (parsed.search !== '' || parsed.hash !== '')
+        ? '/'
+        : parsed.pathname;
+    if (!pathname.startsWith('/')) {
+        return undefined;
+    }
+    return normalizeRootRelativeRoute(`${pathname}${parsed.search}${parsed.hash}`) ?? null;
+}
+function toOpenUrlEvent(url, source, route) {
+    return route === undefined ? { url, source } : { url, source, route };
+}
 /**
  * Owns only handles it registers. Disposing during an awaited addListener
  * removes the eventual handle without touching another gateway's listeners.
@@ -98,6 +129,12 @@ export function createCapacitorAppEvents(input) {
         if (kind === null) {
             return;
         }
+        const route = kind === 'game' ? readGameLinkRoute(url) : undefined;
+        if (route === null) {
+            // A game link whose path could name another host is discarded like an
+            // unknown URL: no router may open it.
+            return;
+        }
         const callbacks = kind === 'game' ? gameUrlCallbacks : oauthCallbacks;
         if (!initialResolved && callbacks.size > 0) {
             // Keep enough recent entries to suppress a cold/warm duplicate without
@@ -110,7 +147,7 @@ export function createCapacitorAppEvents(input) {
             }
             warmUrlsBeforeInitial.add(url);
         }
-        const event = { url, source: 'warm' };
+        const event = toOpenUrlEvent(url, 'warm', route);
         for (const callback of [...callbacks]) {
             try {
                 callback(event);
@@ -239,9 +276,13 @@ export function createCapacitorAppEvents(input) {
             if (kind === null) {
                 return null;
             }
+            const route = kind === 'game' ? readGameLinkRoute(url) : undefined;
+            if (route === null) {
+                return null;
+            }
             recentColdUrl = url;
             recentColdUntil = Date.now() + coldUrlDedupeWindowMs;
-            return { kind, event: { url, source: 'cold' } };
+            return { kind, event: toOpenUrlEvent(url, 'cold', route) };
         }, (error) => {
             initialResolved = true;
             warmUrlsBeforeInitial.clear();

package/dist/commerce-bridge.d.ts

@@ -1,5 +1,4 @@
-import { type BridgeCommerceV2Method, type BridgeEvent, type BridgeRequest, type BridgeResponse } from '@mpgd/bridge';
-import { type PlatformProviderFeature } from '@mpgd/platform';
+import { type BridgeCommerceEvent, type BridgeCommerceV2Method, type BridgeRequest, type BridgeResponse } from '@mpgd/bridge';
 import { type CommerceBridgeMethods, type CommerceProvider, type StoreId } from '@mpgd/platform/commerce';
 import type { CapacitorCommerceServiceProvider } from './providers.js';
 /** Bridge error for a commerce v2 payload the typia assert rejected. */
@@ -9,7 +8,7 @@ export declare const commerceV2MethodUnsupportedBridgeErrorCode: 'COMMERCE_V2_ME
 export interface CommerceProviderBridge {
   request(input: BridgeRequest): Promise<BridgeResponse>;
   /** Delivers `{ protocol: 'mpgd.commerce.v2', sequence, event }`; `sequence` starts at 0 per bridge. */
-  subscribe(listener: (event: BridgeEvent) => void): () => void;
+  subscribe(listener: (event: BridgeCommerceEvent) => void): () => void;
 }
 export interface CreateCommerceProviderBridgeInput {
   readonly provider: CommerceProvider;
@@ -21,25 +20,22 @@ export interface CreateCommerceProviderBridgeInput {
 /**
 * In-process `NativeBridge` over a commerce v2 provider: the six
 * `commerce.v2.*` methods validate their payload and result with the
-* `@mpgd/platform/commerce` asserts, the four v1 `commerce.*` methods are
-* served by `toCommerceAdapter(provider)`, and events carry the bridge envelope
-* with a per-session sequence. A thrown failure crosses the bridge as
+* `@mpgd/platform/commerce` asserts, and events carry the bridge envelope
+* with a per-session sequence. Any other method goes to `fallback`, or answers
+* `UNSUPPORTED_METHOD` without one. A thrown failure crosses the bridge as
 * `{ code, message, retryable }`; a `cancelled` or `failed` purchase result
 * keeps its `storeCode` because it is data, not an error.
 */
 export declare function createCommerceProviderBridge(input: CreateCommerceProviderBridgeInput): CommerceProviderBridge;
-export type CapacitorCommerceFeature = Extract<PlatformProviderFeature, 'nativeIap' | 'subscriptionIap'>;
 export interface CreateCommerceServiceProviderInput {
   readonly id: string;
   readonly commerce: CommerceProvider;
-  /** Commerce features the provider serves. Defaults to `['nativeIap']`. */
-  readonly features?: readonly CapacitorCommerceFeature[];
 }
 /**
-* Registry entry for a commerce v2 provider: the implied commerce bridge
-* methods are served in process by `createCommerceProviderBridge`, and the
-* registry derives `nativeIap` and `subscriptionIap` readiness from
-* `commerce.getCapabilities()`.
+* Registry entry for a commerce provider: it declares no feature and no
+* method, the six `commerce.v2.*` methods are implied and served in process by
+* `createCommerceProviderBridge`, and the gateway's `commerce` capability block
+* is the provider's own `getCapabilities()` answer.
 */
 export declare function createCommerceServiceProvider(input: CreateCommerceServiceProviderInput): CapacitorCommerceServiceProvider;
 /** Validates a commerce v2 result; a provider answer the contract rejects never reaches the caller. */
@@ -48,7 +44,7 @@ export interface CreateBridgeCommerceProviderInput {
   readonly store: StoreId;
   /** Sends one validated bridge request; the gateway's `request` fits. */
   readonly request: <TData>(method: BridgeCommerceV2Method, payload: unknown) => Promise<TData>;
-  readonly subscribe: (listener: (event: BridgeEvent) => void) => () => void;
+  readonly subscribe: (listener: (event: BridgeCommerceEvent) => void) => () => void;
 }
 /**
 * `CommerceProvider` over a bridge that serves the `commerce.v2.*` methods and

package/dist/commerce-bridge.js

@@ -1,29 +1,22 @@
-import { assertBridgeEvent, bridgeEventProtocol, createBridgeError, isBridgeCommerceV2Method, } from '@mpgd/bridge';
-import { PlatformOperationError, } from '@mpgd/platform';
-import { assertCommerceBridgeFetchProductsPayload, assertCommerceBridgeFetchProductsResult, assertCommerceBridgeFinishTransactionPayload, assertCommerceBridgeFinishTransactionResult, assertCommerceBridgeGetAvailablePurchasesPayload, assertCommerceBridgeGetAvailablePurchasesResult, assertCommerceBridgeGetCapabilitiesPayload, assertCommerceBridgeGetCapabilitiesResult, assertCommerceBridgeRequestPurchasePayload, assertCommerceBridgeRequestPurchaseResult, assertCommerceBridgeRestorePurchasesPayload, assertCommerceBridgeRestorePurchasesResult, CommerceError, commerceErrorInfoOf, commerceProtocol, commerceProtocolVersion, toCommerceAdapter, } from '@mpgd/platform/commerce';
+import { bridgeCommerceEventProtocol, createBridgeError, isBridgeCommerceV2Method, } from '@mpgd/bridge';
+import { PlatformOperationError } from '@mpgd/platform';
+import { assertCommerceBridgeFetchProductsPayload, assertCommerceBridgeFetchProductsResult, assertCommerceBridgeFinishTransactionPayload, assertCommerceBridgeFinishTransactionResult, assertCommerceBridgeGetAvailablePurchasesPayload, assertCommerceBridgeGetAvailablePurchasesResult, assertCommerceBridgeGetCapabilitiesPayload, assertCommerceBridgeGetCapabilitiesResult, assertCommerceBridgeRequestPurchasePayload, assertCommerceBridgeRequestPurchaseResult, assertCommerceBridgeRestorePurchasesPayload, assertCommerceBridgeRestorePurchasesResult, assertCommerceEventEnvelope, CommerceError, commerceErrorInfoOf, commerceProtocol, commerceProtocolVersion, } from '@mpgd/platform/commerce';
 import { normalizeStoreSdkError } from './store-sdk.js';
 /** Bridge error for a commerce v2 payload the typia assert rejected. */
 export const commerceV2InvalidPayloadBridgeErrorCode = 'COMMERCE_V2_INVALID_PAYLOAD';
 /** Bridge error for a v2 method the provider does not implement (`finishTransaction`). */
 export const commerceV2MethodUnsupportedBridgeErrorCode = 'COMMERCE_V2_METHOD_UNSUPPORTED';
-const v1CommerceMethods = Object.freeze([
-    'commerce.getProducts',
-    'commerce.purchase',
-    'commerce.restore',
-    'commerce.getEntitlements',
-]);
 /**
  * In-process `NativeBridge` over a commerce v2 provider: the six
  * `commerce.v2.*` methods validate their payload and result with the
- * `@mpgd/platform/commerce` asserts, the four v1 `commerce.*` methods are
- * served by `toCommerceAdapter(provider)`, and events carry the bridge envelope
- * with a per-session sequence. A thrown failure crosses the bridge as
+ * `@mpgd/platform/commerce` asserts, and events carry the bridge envelope
+ * with a per-session sequence. Any other method goes to `fallback`, or answers
+ * `UNSUPPORTED_METHOD` without one. A thrown failure crosses the bridge as
  * `{ code, message, retryable }`; a `cancelled` or `failed` purchase result
  * keeps its `storeCode` because it is data, not an error.
  */
 export function createCommerceProviderBridge(input) {
     const { provider } = input;
-    const adapter = toCommerceAdapter(provider);
     const listeners = new Set();
     let sequence = 0;
     let detach;
@@ -75,17 +68,6 @@ export function createCommerceProviderBridge(input) {
                 await provider.restorePurchases();
                 return assertResult('commerce.v2.restorePurchases', { restored: true });
             }
-            case 'commerce.getProducts':
-                return adapter.getProducts();
-            case 'commerce.purchase':
-                return adapter.purchase(payload);
-            case 'commerce.restore':
-                if (adapter.restore === undefined) {
-                    return { restoredEntitlements: [] };
-                }
-                return adapter.restore();
-            case 'commerce.getEntitlements':
-                return adapter.getEntitlements();
             default:
                 throw new PlatformOperationError({
                     code: 'UNSUPPORTED_METHOD',
@@ -95,9 +77,7 @@ export function createCommerceProviderBridge(input) {
     };
     return {
         async request(request) {
-            const isCommerce = isBridgeCommerceV2Method(request.method)
-                || v1CommerceMethods.includes(request.method);
-            if (!isCommerce && input.fallback !== undefined) {
+            if (!isBridgeCommerceV2Method(request.method) && input.fallback !== undefined) {
                 return input.fallback.request(request);
             }
             try {
@@ -123,15 +103,15 @@ export function createCommerceProviderBridge(input) {
     };
 }
 /**
- * Registry entry for a commerce v2 provider: the implied commerce bridge
- * methods are served in process by `createCommerceProviderBridge`, and the
- * registry derives `nativeIap` and `subscriptionIap` readiness from
- * `commerce.getCapabilities()`.
+ * Registry entry for a commerce provider: it declares no feature and no
+ * method, the six `commerce.v2.*` methods are implied and served in process by
+ * `createCommerceProviderBridge`, and the gateway's `commerce` capability block
+ * is the provider's own `getCapabilities()` answer.
  */
 export function createCommerceServiceProvider(input) {
     return {
         id: input.id,
-        features: input.features ?? ['nativeIap'],
+        features: [],
         methods: [],
         commerce: input.commerce,
         bridge: createCommerceProviderBridge({ provider: input.commerce }),
@@ -226,14 +206,18 @@ export function createBridgeCommerceProvider(input) {
         },
         subscribe(listener) {
             return input.subscribe((envelope) => {
-                // Another protocol on a shared event channel is not ours to judge.
-                if (typeof envelope === 'object' && envelope !== null
-                    && envelope.protocol !== bridgeEventProtocol) {
+                // Another protocol on a shared event channel is not ours to judge; an
+                // envelope without a protocol is malformed and must reach the
+                // validator, as in the Apps in Toss provider.
+                const protocol = typeof envelope === 'object' && envelope !== null
+                    ? envelope.protocol
+                    : undefined;
+                if (typeof protocol === 'string' && protocol !== bridgeCommerceEventProtocol) {
                     return;
                 }
                 let event;
                 try {
-                    event = assertBridgeEvent(envelope);
+                    event = assertCommerceEventEnvelope(envelope);
                 }
                 catch (error) {
                     listener({

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { type PlatformGateway, type PlatformTarget, type ViewportAdapter } from '@mpgd/platform';
 import { type CapacitorAppEventsApi, type CapacitorIncomingUrlKind, type CapacitorVisibilitySource } from './app-events.js';
 import { type CapacitorServiceProvider, type NativeBridge } from './providers.js';
-export { createCapacitorProviderRegistry, createDegradedCommerceCapabilities, deriveCommerceFeatureStates, type CapacitorCommerceServiceProvider, type CapacitorProviderCapabilitySnapshot, type CapacitorProviderRegistry, type CapacitorServiceProvider, type NativeBridge, } from './providers.js';
-export { assertCommerceBridgeResult, commerceV2InvalidPayloadBridgeErrorCode, commerceV2MethodUnsupportedBridgeErrorCode, createBridgeCommerceProvider, createCommerceProviderBridge, createCommerceServiceProvider, type CapacitorCommerceFeature, type CommerceProviderBridge, type CreateBridgeCommerceProviderInput, type CreateCommerceProviderBridgeInput, type CreateCommerceServiceProviderInput, } from './commerce-bridge.js';
+export { createCapacitorProviderRegistry, createDegradedCommerceCapabilities, type CapacitorCommerceServiceProvider, type CapacitorProviderCapabilitySnapshot, type CapacitorProviderRegistry, type CapacitorServiceProvider, type NativeBridge, } from './providers.js';
+export { assertCommerceBridgeResult, commerceV2InvalidPayloadBridgeErrorCode, commerceV2MethodUnsupportedBridgeErrorCode, createBridgeCommerceProvider, createCommerceProviderBridge, createCommerceServiceProvider, type CommerceProviderBridge, type CreateBridgeCommerceProviderInput, type CreateCommerceProviderBridgeInput, type CreateCommerceServiceProviderInput, } from './commerce-bridge.js';
 export { createStoreCommerceProvider, recoverableErrorCodes, type CreateStoreCommerceProviderInput, type StoreCommerceCapabilityOverrides, type StoreCommerceProductMapping, type StoreCommerceProvider, } from './store-commerce-provider.js';
 export { defaultStoreSdkErrorCodeMap, normalizeStoreSdkError, type StoreSdk, type StoreSdkCapabilities, type StoreSdkError, type StoreSdkErrorCodeMap, type StoreSdkEvent, type StoreSdkEventName, type StoreSdkEventOf, type StoreSdkFetchProductsInput, type StoreSdkFinishTransactionInput, type StoreSdkFinishTransactionResult, type StoreSdkGetAvailablePurchasesInput, type StoreSdkProduct, type StoreSdkPurchase, type StoreSdkRequestPurchaseInput, type StoreSdkRequestPurchaseResult, } from './store-sdk.js';
 export { createCapacitorAppEvents, type CapacitorAppEventsApi, type CapacitorIncomingUrlKind, type CapacitorVisibilitySource, } from './app-events.js';

package/dist/index.js

@@ -1,26 +1,19 @@
-import { decodeBridgeCredentialLoadData, decodeBridgeStorageLoadData, } from '@mpgd/bridge';
+import { bridgeCommerceEventProtocol, decodeBridgeCredentialLoadData, decodeBridgeStorageLoadData, } from '@mpgd/bridge';
 import { CapacitorGameServices } from '@mpgd/capacitor-game-services';
 import { PlatformOperationError, } from '@mpgd/platform';
-import { deriveLegacyCommerceCapabilities } from '@mpgd/platform/commerce';
+import { withShareIntentCheck } from '@mpgd/platform/routes';
 import { createCapacitorAppEvents, } from './app-events.js';
 import { createBridgeCommerceProvider } from './commerce-bridge.js';
 import { assertProviderResponseData, createCapacitorProviderRegistry, } from './providers.js';
+import { assertNotificationsV2Served, externalActivityMethods } from './request-policy.js';
 import { createCapacitorViewport } from './viewport.js';
-export { createCapacitorProviderRegistry, createDegradedCommerceCapabilities, deriveCommerceFeatureStates, } from './providers.js';
+export { createCapacitorProviderRegistry, createDegradedCommerceCapabilities, } from './providers.js';
 export { assertCommerceBridgeResult, commerceV2InvalidPayloadBridgeErrorCode, commerceV2MethodUnsupportedBridgeErrorCode, createBridgeCommerceProvider, createCommerceProviderBridge, createCommerceServiceProvider, } from './commerce-bridge.js';
 export { createStoreCommerceProvider, recoverableErrorCodes, } from './store-commerce-provider.js';
 export { defaultStoreSdkErrorCodeMap, normalizeStoreSdkError, } from './store-sdk.js';
 export { createCapacitorAppEvents, } from './app-events.js';
 export { CapacitorNativeHttpError, createCapacitorNativeJsonTransport, } from './native-http.js';
 export { createCapacitorViewport, } from './viewport.js';
-const externalActivityMethods = new Set([
-    'commerce.purchase',
-    'commerce.v2.requestPurchase',
-    'ads.showRewarded',
-    'ads.showInterstitial',
-    'identity.requestUpgrade',
-    'notifications.requestSubscription',
-]);
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -59,15 +52,28 @@ export function createCapacitorPlatformGateway(input) {
     const adProvider = providers.byMethod.get('ads.showRewarded')?.adProvider
         ?? providers.byMethod.get('ads.showInterstitial')?.adProvider;
     const commerceProvider = providers.commerce;
-    // The v2 surface is served through the same request path as every other
-    // provider method, so the bridge envelope, response validation, and external
-    // activity bookkeeping are exercised in process exactly as over a transport.
-    const commerceV2 = commerceProvider === undefined
+    // The commerce provider is served through the same request path as every
+    // other provider method, so the bridge envelope, response validation, and
+    // external activity bookkeeping are exercised in process exactly as over a
+    // transport.
+    const commerce = commerceProvider === undefined
         ? undefined
         : createBridgeCommerceProvider({
             store: commerceProvider.commerce.store,
             request: (method, payload) => request(method, payload),
-            subscribe: (listener) => commerceProvider.bridge.subscribe(listener),
+            // The provider's channel (`NativeBridge`) may carry other protocols.
+            // Only an envelope that names another protocol is dropped; anything
+            // else, a malformed envelope included, reaches the commerce
+            // provider's validator.
+            subscribe: (listener) => commerceProvider.bridge.subscribe((envelope) => {
+                const protocol = typeof envelope === 'object' && envelope !== null
+                    ? envelope.protocol
+                    : undefined;
+                if (typeof protocol === 'string' && protocol !== bridgeCommerceEventProtocol) {
+                    return;
+                }
+                listener(envelope);
+            }),
         });
     const lifecycle = createCapacitorAppEvents({
         target: input.target,
@@ -100,6 +106,9 @@ export function createCapacitorPlatformGateway(input) {
         },
     };
     async function request(method, payload, leaderboardRoute) {
+        // Before any pause: an unserved notifications v2 method never reaches the
+        // base plugin, which speaks no v2.
+        assertNotificationsV2Served(method, providers.byMethod.has(method));
         const releaseExternalActivity = externalActivityMethods.has(method)
             ? lifecycle.beginExternalActivity?.()
             : undefined;
@@ -110,29 +119,14 @@ export function createCapacitorPlatformGateway(input) {
                 ? undefined
                 : providers.byMethod.get(method);
             if (provider !== undefined) {
-                let productType;
-                if (method === 'commerce.purchase'
-                    && provider.features.includes('nativeIap')
-                    && provider.features.includes('subscriptionIap')) {
-                    // The caller supplies only an ID. Resolve its provider-owned type before
-                    // selecting a store route; a forged or unknown ID must not bypass it.
-                    const products = await request('commerce.getProducts', {});
-                    const productId = isRecord(payload) ? payload.productId : undefined;
-                    const matches = products.filter((product) => product.id === productId);
-                    if (matches.length !== 1) {
-                        throw new PlatformOperationError({ code: 'NATIVE_PROVIDER_PRODUCT_UNKNOWN' });
-                    }
-                    productType = matches[0]?.type;
-                }
                 try {
-                    await providers.assertMethodReady(method, payload, productType);
+                    await providers.assertMethodReady(method, payload);
                     const data = await sendRequest(method, payload, provider);
                     if (releaseExternalActivity !== undefined
                         && method === 'commerce.v2.requestPurchase'
                         && isRecord(data) && data.outcome === 'launched') {
                         // The store UI is still open: stay paused until this product's
-                        // purchase event arrives or the safety timeout ends. The v1 path
-                        // has no event to wait for and releases when its request returns.
+                        // purchase event arrives or the safety timeout ends.
                         holdActivity = true;
                         holdLaunchedPurchaseActivity(releaseExternalActivity, isRecord(payload) ? payload.logicalId : undefined);
                     }
@@ -179,7 +173,13 @@ export function createCapacitorPlatformGateway(input) {
         if (commerceProvider === undefined) {
             return;
         }
-        const subscription = commerceProvider.bridge.subscribe(({ event }) => {
+        const subscription = commerceProvider.bridge.subscribe((envelope) => {
+            // Only this purchase's commerce events end the hold; the channel may
+            // carry other protocols.
+            if (envelope.protocol !== bridgeCommerceEventProtocol) {
+                return;
+            }
+            const { event } = envelope;
             if (event.type === 'subscriptionUpdated') {
                 return;
             }
@@ -245,28 +245,29 @@ export function createCapacitorPlatformGateway(input) {
         target: input.target,
         async getCapabilities() {
             const base = await request('runtime.getCapabilities', {});
+            // A native shell built before the commerce v2 removals may still send the
+            // retired boolean flags; the commerce block is the only commerce source.
+            const { nativeIap: _retiredNativeIap, subscriptionIap: _retiredSubscriptionIap, ...native } = (isRecord(base) ? base : {});
             // One bounded registry read serves the feature states and the commerce
             // block, so a stalled or invalid provider degrades the snapshot instead
-            // of rejecting it, and the boolean flags always follow the block.
-            const { availability: states, commerce } = await providers.getCapabilitySnapshot();
+            // of rejecting it, and a missing or invalid native `commerce` answer is
+            // always replaced by the provider's block or the unsupported block.
+            const { availability: states, commerce: commerceCapabilities } = await providers.getCapabilitySnapshot();
             const rewardedAds = states.rewardedAds === 'available';
             const interstitialAds = states.interstitialAds === 'available';
             const bannerAds = states.bannerAds === 'available';
-            const legacy = commerce === undefined ? undefined : deriveLegacyCommerceCapabilities(commerce);
             return {
-                ...base,
-                nativeIap: legacy?.nativeIap ?? states.nativeIap === 'available',
-                subscriptionIap: legacy?.subscriptionIap ?? states.subscriptionIap === 'available',
+                ...native,
                 nativeAds: rewardedAds || interstitialAds || bannerAds,
                 rewardedAds,
                 interstitialAds,
                 bannerAds,
                 nativeLeaderboard: states.nativeLeaderboard === 'available',
                 providerAvailability: states,
-                ...(commerce === undefined ? {} : { commerce }),
+                commerce: commerceCapabilities,
             };
         },
-        ...(commerceV2 === undefined ? {} : { commerceV2 }),
+        ...(commerce === undefined ? {} : { commerce }),
         identity: {
             getPlayer: () => request('identity.getPlayer', {}),
             getSession: () => request('identity.getSession', {}),
@@ -276,20 +277,16 @@ export function createCapacitorPlatformGateway(input) {
             getLaunchIntent: () => request('presentation.getLaunchIntent', {}),
             requestGameSurface: (payload) => request('presentation.requestGameSurface', payload),
         },
-        sharing: {
+        // The bridge's host may build a share URL from the link, so it only ever
+        // sees an intent the ShareIntent contract accepts, with the link normalized.
+        sharing: withShareIntentCheck({
             share: (payload) => request('share.share', payload),
             readInboundShare: () => request('share.readInboundShare', {}),
-        },
+        }),
         notifications: {
             getStatus: (topic) => request('notifications.getStatus', { topic }),
             requestSubscription: (topic) => request('notifications.requestSubscription', { topic }),
         },
-        commerce: {
-            getProducts: () => request('commerce.getProducts', {}),
-            purchase: (payload) => request('commerce.purchase', payload),
-            restore: () => request('commerce.restore', {}),
-            getEntitlements: () => request('commerce.getEntitlements', {}),
-        },
         ads: {
             ...(adProvider === undefined ? {} : { provider: adProvider }),
             preload: (payload) => request('ads.preload', payload),

package/dist/providers.d.ts

@@ -1,12 +1,13 @@
 import { type BridgeEvent, type BridgeMethod, type BridgeRequest, type BridgeResponse } from '@mpgd/bridge';
 import type { AdProvider } from '@mpgd/platform/ads';
-import { type CommerceCapabilities, type PlatformProviderAvailability, type PlatformProviderFeature, type ProductType } from '@mpgd/platform';
+import { type CommerceCapabilities, type PlatformProviderAvailability, type PlatformProviderFeature } from '@mpgd/platform';
 import { type CommerceProvider } from '@mpgd/platform/commerce';
 export interface NativeBridge {
   request(input: BridgeRequest): Promise<BridgeResponse>;
   /**
-  * Optional commerce v2 event delivery (`{ protocol: 'mpgd.commerce.v2', sequence, event }`).
-  * B1 wires it for store providers; the base gateway works without it.
+  * Optional event delivery in the bridge envelopes, told apart by `protocol`
+  * (`{ protocol: 'mpgd.commerce.v2', sequence, event }` from store
+  * providers). The base gateway works without it.
   */
   subscribe?(listener: (event: BridgeEvent) => void): () => void;
 }
@@ -20,23 +21,28 @@ export interface CapacitorServiceProvider {
   readonly id: string;
   /**
   * Serves the declared `methods`. For a provider with `commerce`, it also
-  * serves the ten commerce bridge methods and must implement `subscribe`;
+  * serves the six `commerce.v2.*` methods and must implement `subscribe`;
   * `createCommerceServiceProvider` builds one from a `CommerceProvider`.
   */
   readonly bridge: NativeBridge;
+  /**
+  * The non-commerce features this provider serves. A provider with `commerce`
+  * may declare none: commerce readiness is the provider's own capability
+  * block, not a feature.
+  */
   readonly features: readonly PlatformProviderFeature[];
   /**
-  * Declared v1 bridge methods. A provider with `commerce` declares no
-  * `commerce.*` method: the four v1 commerce methods and the six
-  * `commerce.v2.*` methods are implied and owned by the v2 provider.
+  * Declared bridge methods, owned through `features`. A provider with
+  * `commerce` declares no `commerce.v2.*` method: the six are implied and
+  * owned by the commerce provider, so its own list may be empty.
   */
   readonly methods: readonly BridgeMethod[];
   /** Optional native event surface. The base adapter never imports its SDK. */
   readonly adProvider?: AdProvider;
   /**
-  * Optional commerce v2 provider (`createStoreCommerceProvider`). Its
-  * `getCapabilities()` is the readiness of the declared `nativeIap` and
-  * `subscriptionIap` features; `getAvailability` covers the other features.
+  * Optional commerce provider (`createStoreCommerceProvider`). Its
+  * `getCapabilities()` is the gateway's commerce block; `getAvailability`
+  * covers the declared `features`.
   */
   readonly commerce?: CommerceProvider;
   getAvailability(): Promise<Readonly<Partial<Record<PlatformProviderFeature, PlatformProviderAvailability>>>>;
@@ -49,13 +55,14 @@ export interface CapacitorCommerceServiceProvider extends CapacitorServiceProvid
 export interface CapacitorProviderCapabilitySnapshot {
   readonly availability: Readonly<Record<PlatformProviderFeature, PlatformProviderAvailability>>;
   /**
-  * Present when a commerce v2 provider is registered: its validated
-  * `getCapabilities()` answer from the same bounded read that produced the
-  * `nativeIap` and `subscriptionIap` states, or a degraded block
-  * (`availability: 'temporarily-unavailable'`, nothing sold) when that read
-  * stalled, failed, or returned a shape the contract rejects.
+  * Always present, and a fresh copy on every read: the registered commerce
+  * provider's validated `getCapabilities()` answer, the degraded block
+  * (`availability: 'temporarily-unavailable'`, nothing sold) when that bounded
+  * read stalled, failed, or returned a shape the contract rejects, or
+  * `createUnsupportedCommerceCapabilities()` when no commerce provider is
+  * registered.
   */
-  readonly commerce?: CommerceCapabilities;
+  readonly commerce: CommerceCapabilities;
 }
 export interface CapacitorProviderRegistry {
   readonly byMethod: ReadonlyMap<BridgeMethod, CapacitorServiceProvider>;
@@ -63,16 +70,10 @@ export interface CapacitorProviderRegistry {
   readonly commerce?: CapacitorCommerceServiceProvider;
   /** Feature readiness plus the commerce block, from one bounded read per provider. */
   getCapabilitySnapshot(): Promise<CapacitorProviderCapabilitySnapshot>;
-  assertMethodReady(method: BridgeMethod, payload?: unknown, productType?: ProductType): Promise<void>;
+  assertMethodReady(method: BridgeMethod, payload?: unknown): Promise<void>;
   getAvailability(): Promise<Readonly<Record<PlatformProviderFeature, PlatformProviderAvailability>>>;
 }
 export declare function createCapacitorProviderRegistry(input: readonly CapacitorServiceProvider[]): CapacitorProviderRegistry;
 export declare function assertProviderResponseData(method: BridgeMethod, data: unknown): void;
 /** The commerce block a gateway reports while its provider cannot be read. */
 export declare function createDegradedCommerceCapabilities(): CommerceCapabilities;
-/**
-* Readiness of the commerce features a v2 provider declares, from its own
-* capability declaration: a feature it does not sell is `unsupported`, and a
-* read that failed or stalled is `temporarily-unavailable`.
-*/
-export declare function deriveCommerceFeatureStates(capabilities: CommerceCapabilities | undefined, features: readonly PlatformProviderFeature[]): Partial<Record<PlatformProviderFeature, PlatformProviderAvailability>>;

package/dist/providers.js

@@ -1,21 +1,9 @@
-import { bridgeCommerceV2Methods, isBridgeCommerceV2Method, } from '@mpgd/bridge';
+import { bridgeCommerceV2Methods, isBridgeCommerceV2Method, isBridgeNotificationsV2Method, } from '@mpgd/bridge';
 import { isAdMobClientRewardEvidence } from '@mpgd/game-services/admob-client-reward';
 import { PlatformOperationError, } from '@mpgd/platform';
 import { createUnsupportedCommerceCapabilities, isCommerceCapabilities, } from '@mpgd/platform/commerce';
 import { assertCommerceBridgeResult } from './commerce-bridge.js';
 const featureMethods = {
-    nativeIap: [
-        'commerce.getProducts',
-        'commerce.purchase',
-        'commerce.restore',
-        'commerce.getEntitlements',
-    ],
-    subscriptionIap: [
-        'commerce.getProducts',
-        'commerce.purchase',
-        'commerce.restore',
-        'commerce.getEntitlements',
-    ],
     rewardedAds: ['ads.preload', 'ads.showRewarded'],
     interstitialAds: ['ads.preload', 'ads.showInterstitial'],
     bannerAds: ['ads.mountBanner', 'ads.unmountBanner'],
@@ -25,12 +13,7 @@ const featureMethods = {
 };
 const providerFeatures = Object.keys(featureMethods);
 const providerMethodSet = new Set(Object.values(featureMethods).flat());
-const commerceFeatures = ['nativeIap', 'subscriptionIap'];
-const v1CommerceMethods = featureMethods.nativeIap;
-const impliedCommerceMethods = [
-    ...v1CommerceMethods,
-    ...bridgeCommerceV2Methods,
-];
+const impliedCommerceMethods = bridgeCommerceV2Methods;
 const availabilitySet = new Set([
     'unsupported',
     'configuration-required',
@@ -55,8 +38,8 @@ export function createCapacitorProviderRegistry(input) {
             throw new Error(`Capacitor provider ID is empty or registered twice: ${provider.id}`);
         }
         ids.add(provider.id);
-        if (provider.features.length === 0
-            || (provider.methods.length === 0 && provider.commerce === undefined)) {
+        if (provider.commerce === undefined
+            && (provider.features.length === 0 || provider.methods.length === 0)) {
             throw new Error(`Capacitor provider ${provider.id} must declare features and methods.`);
         }
         const methods = new Set(provider.methods);
@@ -67,16 +50,18 @@ export function createCapacitorProviderRegistry(input) {
             if (isBridgeCommerceV2Method(method)) {
                 // A v2 provider is registered through `commerce`; its bridge methods are implied.
                 throw new Error(`Capacitor provider ${provider.id} cannot declare commerce v2 method ${method}; `
-                    + 'register a v2 provider through `commerce` instead, commerce v2 is unavailable as '
-                    + 'a declared method.');
+                    + 'register a commerce provider through `commerce` instead, commerce v2 is '
+                    + 'unavailable as a declared method.');
+            }
+            if (isBridgeNotificationsV2Method(method)) {
+                // A notifications v2 provider gets its own registry surface (P2); a
+                // declared method would bypass the pass-through readiness rule.
+                throw new Error(`Capacitor provider ${provider.id} cannot declare notifications v2 method ${method}; `
+                    + 'notifications v2 is unavailable as a declared method.');
             }
             if (!providerMethodSet.has(method)) {
                 throw new Error(`Capacitor provider ${provider.id} cannot replace base method ${method}.`);
             }
-            if (provider.commerce !== undefined && v1CommerceMethods.includes(method)) {
-                throw new Error(`Capacitor provider ${provider.id} cannot declare both a commerce v2 provider and `
-                    + `v1 method ${method}; the registry serves v1 callers from the v2 provider.`);
-            }
         }
         const implied = provider.commerce === undefined ? [] : impliedCommerceMethods;
         for (const method of [...methods, ...implied]) {
@@ -85,16 +70,11 @@ export function createCapacitorProviderRegistry(input) {
             }
         }
         const owned = new Set([...methods, ...implied]);
-        if (provider.commerce !== undefined) {
-            if (!provider.features.some((feature) => commerceFeatures.includes(feature))) {
-                throw new Error(`Capacitor provider ${provider.id} declares a commerce v2 provider but no commerce feature.`);
-            }
-            if (provider.bridge.subscribe === undefined) {
-                // Without the event surface a purchase that completes after the store
-                // UI closed would never reach the reconciler.
-                throw new Error(`Capacitor provider ${provider.id} declares a commerce v2 provider but its bridge has no `
-                    + 'subscribe; build it with createCommerceServiceProvider.');
-            }
+        if (provider.commerce !== undefined && provider.bridge.subscribe === undefined) {
+            // Without the event surface a purchase that completes after the store
+            // UI closed would never reach the reconciler.
+            throw new Error(`Capacitor provider ${provider.id} declares a commerce provider but its bridge has no `
+                + 'subscribe; build it with createCommerceServiceProvider.');
         }
         for (const feature of provider.features) {
             const required = featureMethods[feature];
@@ -117,26 +97,27 @@ export function createCapacitorProviderRegistry(input) {
             commerce = provider;
         }
     }
-    const readProviderStates = async (provider) => {
+    const readFeatureStates = async (provider) => {
         const states = {};
-        const commerceOwned = provider.commerce === undefined
-            ? []
-            : provider.features.filter((feature) => commerceFeatures.includes(feature));
-        const bridged = provider.features.filter((feature) => !commerceOwned.includes(feature));
-        let commerceBlock;
-        if (provider.commerce !== undefined && commerceOwned.length > 0) {
-            commerceBlock = await readCommerceCapabilities(provider.commerce);
-            Object.assign(states, deriveCommerceFeatureStates(commerceBlock, commerceOwned));
+        if (provider.features.length === 0) {
+            return states;
         }
-        if (bridged.length > 0) {
-            const reported = await readWithTimeout(Promise.resolve().then(() => provider.getAvailability()));
-            for (const feature of bridged) {
-                const state = isRecord(reported) ? reported[feature] : undefined;
-                states[feature] = availabilitySet.has(state)
-                    ? state
-                    : 'temporarily-unavailable';
-            }
+        const reported = await readWithTimeout(Promise.resolve().then(() => provider.getAvailability()));
+        for (const feature of provider.features) {
+            const state = isRecord(reported) ? reported[feature] : undefined;
+            states[feature] = availabilitySet.has(state)
+                ? state
+                : 'temporarily-unavailable';
         }
+        return states;
+    };
+    const readProviderStates = async (provider) => {
+        const [states, commerceBlock] = await Promise.all([
+            readFeatureStates(provider),
+            provider.commerce === undefined
+                ? Promise.resolve(undefined)
+                : readCommerceCapabilities(provider.commerce),
+        ]);
         return { states, ...(commerceBlock === undefined ? {} : { commerce: commerceBlock }) };
     };
     const getCapabilitySnapshot = async () => {
@@ -150,15 +131,15 @@ export function createCapacitorProviderRegistry(input) {
             Object.assign(states, snapshot.states);
             commerceBlock = snapshot.commerce ?? commerceBlock;
         }
-        if (commerce !== undefined && commerceBlock === undefined) {
-            // One bounded read serves the feature states and the block, so a stalled,
-            // failed, or invalid provider degrades both the same way.
+        if (commerce === undefined) {
+            commerceBlock = createUnsupportedCommerceCapabilities();
+        }
+        else if (commerceBlock === undefined) {
+            // One bounded read serves the block, so a stalled, failed, or invalid
+            // provider degrades it without rejecting the snapshot.
             commerceBlock = createDegradedCommerceCapabilities();
         }
-        return {
-            availability: states,
-            ...(commerceBlock === undefined ? {} : { commerce: commerceBlock }),
-        };
+        return { availability: states, commerce: commerceBlock };
     };
     const getAvailability = async () => (await getCapabilitySnapshot()).availability;
     return {
@@ -166,14 +147,17 @@ export function createCapacitorProviderRegistry(input) {
         ...(commerce === undefined ? {} : { commerce }),
         getAvailability,
         getCapabilitySnapshot,
-        async assertMethodReady(method, payload, productType) {
+        async assertMethodReady(method, payload) {
             const provider = byMethod.get(method);
             if (provider === undefined) {
                 return;
             }
-            if (isBridgeCommerceV2Method(method)) {
-                // The v2 provider reads its own `availability` and fails closed before
-                // any store UI opens; the registry adds no second, stale snapshot.
+            if (isBridgeCommerceV2Method(method) || isBridgeNotificationsV2Method(method)) {
+                // A v2 provider reads its own `availability` and answers with it
+                // (commerce fails closed before any store UI opens; notifications
+                // answer `unsupported` or `action-required` states and outcomes), so
+                // the registry adds no second, stale snapshot that would turn those
+                // answers into errors.
                 return;
             }
             if (method === 'ads.unmountBanner') {
@@ -181,14 +165,10 @@ export function createCapacitorProviderRegistry(input) {
                 // its serving state becomes unavailable.
                 return;
             }
-            // An unrelated provider must not delay a purchase, ad, or identity call.
-            const { states } = await readProviderStates(provider);
+            // An unrelated provider must not delay an ad or identity call, and neither
+            // may its commerce capability read.
+            const states = await readFeatureStates(provider);
             let relevant = provider.features.filter((feature) => featureMethods[feature].includes(method));
-            if (method === 'commerce.purchase' && relevant.length > 1) {
-                relevant = relevant.filter((feature) => feature === (productType === 'subscription' ? 'subscriptionIap'
-                    : productType === 'consumable' || productType === 'non_consumable'
-                        ? 'nativeIap' : undefined));
-            }
             const preloadFormat = method === 'ads.preload' && isRecord(payload)
                 ? payload.format
                 : undefined;
@@ -201,15 +181,9 @@ export function createCapacitorProviderRegistry(input) {
                 relevant = feature === undefined ? [] : relevant.filter((item) => item === feature);
             }
             if (relevant.length === 0) {
-                throw new PlatformOperationError({
-                    code: method === 'commerce.purchase'
-                        ? 'NATIVE_PROVIDER_PRODUCT_TYPE_REQUIRED'
-                        : 'NATIVE_PROVIDER_UNSUPPORTED',
-                });
+                throw new PlatformOperationError({ code: 'NATIVE_PROVIDER_UNSUPPORTED' });
             }
-            const ready = (method === 'ads.preload' && preloadFormat === undefined)
-                || ((method === 'commerce.restore' || method === 'commerce.getEntitlements')
-                    && relevant.length > 1)
+            const ready = method === 'ads.preload' && preloadFormat === undefined
                 ? relevant.every((feature) => states[feature] === 'available')
                 : relevant.some((feature) => states[feature] === 'available');
             if (ready) {
@@ -288,41 +262,12 @@ async function readWithTimeout(read) {
         }
     }
 }
-/**
- * Readiness of the commerce features a v2 provider declares, from its own
- * capability declaration: a feature it does not sell is `unsupported`, and a
- * read that failed or stalled is `temporarily-unavailable`.
- */
-export function deriveCommerceFeatureStates(capabilities, features) {
-    const states = {};
-    const availability = capabilities === undefined
-        || !availabilitySet.has(capabilities.availability)
-        ? 'temporarily-unavailable'
-        : capabilities.availability;
-    for (const feature of features) {
-        if (feature === 'nativeIap') {
-            states.nativeIap = capabilities !== undefined
-                && !(capabilities.purchase.consumable || capabilities.purchase.durable)
-                ? 'unsupported'
-                : availability;
-        }
-        else if (feature === 'subscriptionIap') {
-            states.subscriptionIap = capabilities !== undefined && !capabilities.purchase.subscription
-                ? 'unsupported'
-                : availability;
-        }
-    }
-    return states;
-}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 function isString(value) {
     return typeof value === 'string';
 }
-function isStringArray(value) {
-    return Array.isArray(value) && value.every(isString);
-}
 function isVoidData(value) {
     return value === undefined || value === null || (isRecord(value) && Object.keys(value).length === 0);
 }
@@ -336,47 +281,13 @@ function isValidProviderData(method, value) {
             return false;
         }
     }
+    if (isBridgeNotificationsV2Method(method)) {
+        // P2 must validate these answers here, with `assertBridgeNotificationsV2Result`
+        // from `@mpgd/bridge/notifications`, when it lets a provider serve the
+        // methods. Until then every notifications v2 answer is rejected.
+        return false;
+    }
     switch (method) {
-        case 'commerce.getProducts':
-            return Array.isArray(value) && value.every((product) => isRecord(product)
-                && isString(product.id)
-                && ['consumable', 'non_consumable', 'subscription'].includes(product.type)
-                && isString(product.title)
-                && isString(product.description)
-                && isRecord(product.price)
-                && isString(product.price.formatted)
-                && isString(product.price.currencyCode));
-        case 'commerce.purchase':
-            return isRecord(value)
-                && ['completed', 'cancelled', 'pending', 'failed'].includes(value.status)
-                && isStringArray(value.entitlementIds)
-                && (value.transactionId === undefined || isString(value.transactionId))
-                && (value.authoritativeGrant === undefined || (value.status === 'completed'
-                    && isString(value.transactionId)
-                    && isRecord(value.authoritativeGrant)
-                    && isString(value.authoritativeGrant.ledgerEntryId)
-                    && value.authoritativeGrant.ledgerEntryId.length > 0
-                    && (value.authoritativeGrant.alreadyProcessed === undefined
-                        || typeof value.authoritativeGrant.alreadyProcessed === 'boolean')))
-                && (value.evidence === undefined || isEvidence(value.evidence))
-                && (value.diagnostic === undefined || isCommerceDiagnostic(value.diagnostic));
-        case 'commerce.restore':
-            return isRecord(value)
-                && Array.isArray(value.restoredEntitlements)
-                && value.restoredEntitlements.every(isEntitlement)
-                && (value.settledPurchases === undefined || (Array.isArray(value.settledPurchases)
-                    && value.settledPurchases.every((settlement) => isRecord(settlement)
-                        && isString(settlement.transactionId)
-                        && isString(settlement.productId)
-                        && ['granted', 'refunded'].includes(settlement.status)
-                        && (settlement.ledgerEntryId === undefined || isString(settlement.ledgerEntryId))
-                        && (settlement.alreadyProcessed === undefined
-                            || typeof settlement.alreadyProcessed === 'boolean')
-                        && (settlement.idempotencyKey === undefined
-                            || isIdempotencyKey(settlement.idempotencyKey)))))
-                && (value.diagnostic === undefined || isCommerceDiagnostic(value.diagnostic));
-        case 'commerce.getEntitlements':
-            return Array.isArray(value) && value.every(isEntitlement);
         case 'ads.preload':
         case 'ads.unmountBanner':
         case 'leaderboard.open':
@@ -426,29 +337,6 @@ function isValidProviderData(method, value) {
             return false;
     }
 }
-function isEntitlement(value) {
-    return isRecord(value)
-        && isString(value.id)
-        && ['purchase', 'promotion', 'admin'].includes(value.source)
-        && isString(value.grantedAt)
-        && (value.expiresAt === undefined || isString(value.expiresAt));
-}
-/** Mirrors the stable, non-sensitive code format of `PlatformOperationError`. */
-function isDiagnosticCode(value) {
-    return isString(value) && value.length <= 128 && /^[A-Z][A-Z0-9_:-]*$/u.test(value);
-}
-function isCommerceDiagnostic(value) {
-    return isRecord(value)
-        && isDiagnosticCode(value.code)
-        && typeof value.retryable === 'boolean'
-        && (value.providerCode === undefined || isDiagnosticCode(value.providerCode));
-}
-function isIdempotencyKey(value) {
-    return isString(value)
-        && value.length > 0
-        && value.length <= 256
-        && !/[\p{Cc}\p{Cf}]/u.test(value);
-}
 function isEvidence(value) {
     return isRecord(value)
         && isString(value.schema)

package/dist/request-policy.d.ts

@@ -0,0 +1,16 @@
+import { type BridgeMethod } from '@mpgd/bridge';
+/**
+* Methods that put a native UI over the game, so the gateway pauses the game
+* (`beginExternalActivity`) while one runs: a store sheet, an ad, a sign-in,
+* a permission dialog, or the system settings that
+* `notifications.v2.openSettings` leaves for (notifications RFC "Provider
+* profiles", Capacitor).
+*/
+export declare const externalActivityMethods: ReadonlySet<BridgeMethod>;
+/**
+* Fails closed for a notifications v2 method that no registered provider
+* serves: the base game-services plugin speaks no notifications v2, so the
+* request answers `NOTIFICATIONS_V2_UNAVAILABLE`, which is not retryable,
+* without pausing the game or reaching the plugin.
+*/
+export declare function assertNotificationsV2Served(method: BridgeMethod, served: boolean): void;

package/dist/request-policy.js

@@ -0,0 +1,36 @@
+import { isBridgeNotificationsV2Method, notificationsV2UnavailableBridgeErrorCode, } from '@mpgd/bridge';
+import { PlatformOperationError } from '@mpgd/platform';
+// How the gateway's request path treats a method before routing it. Internal:
+// the package entry does not export this module.
+/**
+ * Methods that put a native UI over the game, so the gateway pauses the game
+ * (`beginExternalActivity`) while one runs: a store sheet, an ad, a sign-in,
+ * a permission dialog, or the system settings that
+ * `notifications.v2.openSettings` leaves for (notifications RFC "Provider
+ * profiles", Capacitor).
+ */
+export const externalActivityMethods = new Set([
+    'commerce.v2.requestPurchase',
+    'ads.showRewarded',
+    'ads.showInterstitial',
+    'identity.requestUpgrade',
+    'notifications.requestSubscription',
+    'notifications.v2.requestPermission',
+    'notifications.v2.openSettings',
+]);
+/**
+ * Fails closed for a notifications v2 method that no registered provider
+ * serves: the base game-services plugin speaks no notifications v2, so the
+ * request answers `NOTIFICATIONS_V2_UNAVAILABLE`, which is not retryable,
+ * without pausing the game or reaching the plugin.
+ */
+export function assertNotificationsV2Served(method, served) {
+    if (served || !isBridgeNotificationsV2Method(method)) {
+        return;
+    }
+    throw new PlatformOperationError({
+        code: notificationsV2UnavailableBridgeErrorCode,
+        message: `No Capacitor provider serves notifications v2; ${method} is unavailable.`,
+        retryable: false,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/adapter-capacitor",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Capacitor platform adapter for mpgd Android and iOS shells.",
   "license": "MIT",
   "repository": {
@@ -32,10 +32,6 @@
     "./admob": {
       "types": "./dist/admob.d.ts",
       "default": "./dist/admob.js"
-    },
-    "./app-store-server": {
-      "types": "./dist/app-store-server.d.ts",
-      "default": "./dist/app-store-server.js"
     }
   },
   "files": [
@@ -43,11 +39,11 @@
   ],
   "dependencies": {
     "@capacitor/app": "8.1.1",
-    "@mpgd/bridge": "0.12.3",
-    "@mpgd/game-services": "0.22.0",
-    "@mpgd/capacitor-game-services": "0.6.5",
-    "@mpgd/platform": "0.22.0",
-    "@mpgd/target-config": "0.22.1"
+    "@mpgd/bridge": "0.13.0",
+    "@mpgd/capacitor-game-services": "0.7.0",
+    "@mpgd/platform": "0.23.0",
+    "@mpgd/target-config": "0.23.0",
+    "@mpgd/game-services": "0.24.0"
   },
   "peerDependencies": {
     "@capacitor-community/admob": "^8.1.0",
@@ -64,7 +60,7 @@
     "ttsc": "0.30.4",
     "typescript": "7.0.2",
     "vitest": "^4.0.0",
-    "@mpgd/game-runtime": "0.6.5"
+    "@mpgd/game-runtime": "0.7.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/app-store-server.d.ts

@@ -1,12 +0,0 @@
-/**
-* @deprecated Moved to `@mpgd/game-services/app-store-server` in A4 of the
-* commerce v2 plan: server-side App Store verification does not belong in the
-* client adapter. This subpath re-exports the same symbols for one release and
-* will be removed in the next major version. Install
-* `@apple/app-store-server-library` next to `@mpgd/game-services`.
-*/
-import { createAppleSignedTransactionVerifier as createAppleSignedTransactionVerifierFromGameServices, type CreateAppleSignedTransactionVerifierOptions as GameServicesAppleVerifierOptions } from '@mpgd/game-services/app-store-server';
-/** @deprecated Import `createAppleSignedTransactionVerifier` from `@mpgd/game-services/app-store-server`. */
-export declare const createAppleSignedTransactionVerifier: typeof createAppleSignedTransactionVerifierFromGameServices;
-/** @deprecated Import `CreateAppleSignedTransactionVerifierOptions` from `@mpgd/game-services/app-store-server`. */
-export type CreateAppleSignedTransactionVerifierOptions = GameServicesAppleVerifierOptions;

package/dist/app-store-server.js

@@ -1,10 +0,0 @@
-/**
- * @deprecated Moved to `@mpgd/game-services/app-store-server` in A4 of the
- * commerce v2 plan: server-side App Store verification does not belong in the
- * client adapter. This subpath re-exports the same symbols for one release and
- * will be removed in the next major version. Install
- * `@apple/app-store-server-library` next to `@mpgd/game-services`.
- */
-import { createAppleSignedTransactionVerifier as createAppleSignedTransactionVerifierFromGameServices, } from '@mpgd/game-services/app-store-server';
-/** @deprecated Import `createAppleSignedTransactionVerifier` from `@mpgd/game-services/app-store-server`. */
-export const createAppleSignedTransactionVerifier = createAppleSignedTransactionVerifierFromGameServices;